EP4140113A1 - Offline-vorrichtungsbereitstellung - Google Patents
Offline-vorrichtungsbereitstellungInfo
- Publication number
- EP4140113A1 EP4140113A1 EP21714567.1A EP21714567A EP4140113A1 EP 4140113 A1 EP4140113 A1 EP 4140113A1 EP 21714567 A EP21714567 A EP 21714567A EP 4140113 A1 EP4140113 A1 EP 4140113A1
- Authority
- EP
- European Patent Office
- Prior art keywords
- premise
- provisioning
- communications network
- network
- network connection
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/2803—Home automation networks
- H04L12/2807—Exchanging configuration information on appliance services in a home automation network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/2803—Home automation networks
- H04L12/283—Processing of data at an internetworking point of a home automation network
- H04L12/2834—Switching of information between an external network and a home network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0803—Configuration setting
- H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/12—Discovery or management of network topologies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
Definitions
- a device provisioning service can be used to authenticate and configure smart devices via an Internet network connection.
- Each smart device connects to a remote DPS via the Internet to request provisioning.
- the remote DPS challenges the smart device to prove its identity before securely configuring the smart device to work with other network-connected devices, service systems, and workloads (collectively, “solutions”). In this way, the smart device can securely communicate with solution systems in the cloud.
- the smart device may be a smart sensor, plug, lightbulb, or another device (e.g., thermostat, doorbell, security camera) that is hardcoded to “wake-up” and begin registering itself with one or more cloud-based DPSs, such as Nokia Smart Home, Google Home®, Samsung SmartThings, Nest, Phillips Hue, Smart Life, Garmin Connect, etc.
- DPSs such as Nokia Smart Home, Google Home®, Samsung SmartThings, Nest, Phillips Hue, Smart Life, Garmin Connect, etc.
- Each DPS then sets up the smart device to work securely with other network-connected solutions.
- the described technology provides a system and method of provisioning an on-premise device within an on-premise communications network.
- the method connects, via a network connection, an on-premise gateway system in the on-premise communications network with an off-premise device provisioning service system in an off-premise communications network.
- One or more device provisioning records are communicated between the off-premise device provisioning service system and an on premise device provisioning service of the on-premise gateway system via the network connection.
- the network connection is disconnected between the on-premise communications network and the off-premise communications network.
- the method responds to a discovery request received from the on-premise device via the on-premise communications network, while the network connection is disconnected.
- a provisioning request from the on-premise device is received at the on-premise device provisioning service of the on-premise gateway system via the on-premise communications network, while the network connection is disconnected.
- An on-premise device provisioning service of the on-premise gateway system provisions the on-premise device based on the one or more provisioning records, while the network connection is disconnected.
- FIG. 1 illustrates example offline device provisioning of a new on-premise device.
- FIG. 2 illustrates an example offline device provisioning system for in gateway solutions.
- FIG. 3 illustrates an example offline device provisioning system for on premise solutions.
- FIG. 4 illustrates an example offline device provisioning system with pre provisioning enrollment.
- FIG. 5 illustrates example operations for offline provisioning with pre provisioning enrollment.
- FIG. 6 illustrates example operations for offline provisioning with post provisioning enrollment.
- FIG. 7 illustrates an example communication device for implementing the features and operations of the described technology.
- a networked- connected device such as an Internet-of-Things (IoT) device, a network-connected industrial asset, a mobile computing device, or another communications device
- IoT Internet-of-Things
- a network-connected industrial asset such as a mobile computing device, or another communications device
- an on-premise network such as an Internet-of-Things (IoT) device, a network-connected industrial asset, a mobile computing device, or another communications device
- IoT Internet-of-Things
- a network-connected industrial asset such as an Internet-of-Things (IoT) device, a network-connected industrial asset, a mobile computing device, or another communications device
- offline device provisioning can support configuring such devices to securely work with devices and services outside the on-premise network after the on-premise network connects to the Internet.
- FIG. 1 illustrates example offline device provisioning of a new on-premise device 100.
- the on-premise location is a drill site with an unreliable Internet connection, although other on-premise locations are contemplated.
- the drill site has control systems, sensors, monitoring services, and other on-premise solutions.
- solutions is defined herein as “network- connected devices, services, and/or workloads.”
- new on-premise devices are added at the on-premise location, and these devices require provisioning in order to work with the other on-premise solutions, even when an Internet connection is not available.
- These on-premise devices may also require provisioning for remote (e.g., cloud- based) solutions when an Internet connection is available or re-established.
- an on-premise pressure sensor may be added at the drill site and provisioned to work with an on-premise pressure monitoring service.
- the on-premise sensor may also require provisioning for remote (i.e., off-premise) solutions, such as software updating systems, calibration services, and maintenance logging solutions (see, e.g., off-premise devices 120 and off-premise services systems 122).
- off-premise solutions such as software updating systems, calibration services, and maintenance logging solutions (see, e.g., off-premise devices 120 and off-premise services systems 122).
- the off-premise DPS system can provision the new on-premise device, authenticating the new on-premise device and registering its cryptographic identity with various on-premise and off-premise solutions.
- the new on-premise pressure sensor cannot communicatively connect to the Internet communications network, the new on-premise pressure sensor cannot connect to the off-premise DPS system for provisioning. Nevertheless, until the Internet connection is re-established, the drill site operator may still wish that the on premise pressure sensor is provisioned to work with the other on-premise solutions. Such provisioning is referred to as “offline device provisioning.”
- the new on-premise device 100 is powered up (and/or connected other on-premise systems) and attempts to obtain provisioning.
- the new on premise device 100 can connect to an on-premise gateway system 102 that has a potentially unreliable network connection (see, e.g., a network connection 104) to an Internet communications network 106 (referred to as a type of “off-premise communications network”).
- the on-premise gateway system 102 is a computing device or communications device that is part of an on-premise communications network 112.
- the on-premise gateway system 102 connects to the on-premise communications network 112 via an on-premise network interface 126, which includes hardware components.
- the on premise gateway system 102 can connect the systems and solutions in the on-premise communications network 112 with the Internet communications network 106 via the network connection 104.
- the on-premise gateway system 102 connects to the Internet communications network 106 via an off-premise network interface 124, which includes hardware components.
- the new on-premise device 100 can connect through the on-premise gateway system 102 to an identified offline device provisioning service (see, e.g., the off- premise DPS system 108) via the Internet communications network 106, then the new on premise device 100 sends a device provisioning request to an off-premise DPS system 108.
- the new on-premise device 100 sends the device provisioning request with a DPS identifier to a pre-defmed URL.
- a service at the pre-defmed URL re directs the device provisioning request to the identified DPS, which interacts with the new on-premise device 100 to begin the provisioning process (e.g., authenticating the identity of the on-premise device 100, registering that identity with one or more on-premise and/or off-premise solutions, etc.).
- the network connection 104 does not provide an active connection between the on-premise gateway system and the Internet communications network 106, then the off-premise DPS system 108 is unavailable, and the new on-premise device 100 seeks provisioning from an alternative provisioning source.
- the alternative provisioning source is an on-premise DPS 110 of the on-premise gateway system 102, which is communicatively coupled with the new on premise device 100 via an on-premise communications network 112.
- the on-premise DPS 110 is capable of provisioning on-premise devices, securely registering them to work with other on-premise solutions, such as one or more on-premise solutions 114.
- the new on-premise device 100 initiates a discovery process on the on-premise communications network 112, such as by sending out a multicast DNS query for a given service type and domain.
- the discovery process enables the automatic discovery of devices and services on a local network using industry-standard IP protocols.
- the discovery process allows the new on premise device 100 to find all available instances of a particular type of service (represented as discovery endpoints) on the on-premise communications network 112 and to maintain a list of identified services and their corresponding port numbers.
- the new on- premise device 100 can then resolve the service hostnames to a list of IPv4 and IPv6 addresses.
- the list of named services provides a layer of indirection between a service and its current DNS name and port number.
- Indirection allows applications to keep a persistent list of available services and resolve an actual network address just prior to using a service.
- the list allows services to be relocated dynamically without generating a lot of network traffic announcing the change.
- the discovery process allows the new on-premise device 100 to identify and set up communications with a discovery endpoint in the on-premise gateway system 102, which is capable of providing the on-premise DPS 110. Thereafter, the new on-premise device 100 can request provisioning from the on premise DPS 110 using standard device provisioning service protocols.
- the on-premise DPS 110 attempts to authenticate the new on-premise device 100 (typically challenging the new on-premise device 100 to prove its identity). Once the on-premise DPS 110 has authenticated the identity of new on-premise device 100, the on-premise DPS 110 registers the identity of new on-premise device 100 to communicate with the one or more on-premise solutions 114. Other provisioning operations may also be employed, including without limitation, setting and enforcing policies, setting SSIDs, storing local SSIDs and credentials, and other operational parameters. In this way, the new on-premise device 100 is provisioned to work/interact with one or more on-premise solutions 114.
- FIG. 2 illustrates an example offline device provisioning system 201 for in gateway solutions 214.
- An in-gateway solution can include a device, a service, and/or a workload operating in an on-premise gateway system 202.
- the on-premise gateway system 202 is a computing device or communications device that is part of an on-premise communications network 212.
- the on-premise gateway system 202 can connect the systems and solutions in the on-premise communications network 212 with the Internet communications network 206 via the network connection 204.
- a new on-premise device 200 is powered up (and/or electrically connected to other on-premise systems) and attempts to obtain provisioning.
- the new on-premise device 200 connects to an on-premise gateway system 202 and finds that the network connection 204 to an Internet communications network 206 (referred to as a type of “off- premise communications network”) is unavailable.
- an off- premise communications network referred to as a type of “off- premise communications network”
- provisioning by an off- premise DPS system 208 is unavailable at that time.
- the new on-premise device 200 initiates a discovery process within an on-premise communications network 212.
- the discovery process identifies a discovery endpoint 207 associated with an on-premise DPS 210.
- the on-premise DPS 210 is capable of provisioning on-premise devices, securely registering them to work with other on-premise solutions, such as one or more in-gateway solutions 214. If successful, the discovery process allows the new on-premise device 200 to identify and set up communications with the on-premise DPS 210 in the on-premise gateway system 202. Thereafter, the new on-premise device 200 can obtain provisioning from the on-premise DPS 210 using standard device provisioning service protocols.
- the on-premise DPS 210 attempts to authenticate the new on-premise device 200 (typically challenging the new on-premise device 200 to prove its identity).
- the on-premise DPS 210 relies on a gateway identity brokering system 209 to source and/or store cryptographic identities of the one or more in gateway solutions 214.
- Such cryptographic identities are a type of device provisioning record that may be generated by or sourced from an in-gateway certificate authority or another identity issuer. Such identities may also be generated or sourced from off-premise systems and communicated to and stored on the gateway identity brokering system 209 when the Internet connection is active.
- Other device provisioning records such as public keys, SSIDs, enrollment records, etc., may also be stored by the on-premise DPS 210 or the gateway identity brokering system 209.
- the on-premise DPS 210 registers the identity of the new on-premise device 200 to communicate with the one or more in-gateway solutions 214.
- Other provisioning operations may also be employed, including without limitation, setting and enforcing policies, setting SSIDs, storing local SSIDs and credentials, and other operational parameters. In this way, the new on-premise device 200 is provisioned to work/interact with the one or more in-gateway solutions 214.
- FIG. 3 illustrates an example offline device provisioning system 301 for one or more on-premise solutions 314.
- An on-premise solution can include a device, a service, and/or a workload operating in an on-premise communications network 312.
- the on-premise gateway system 302 is a computing device or communications device that is part of the on-premise communications network 312.
- the on-premise gateway system 302 can connect the one or more on-premise solutions 314 in the on-premise communications network 312 with the Internet communications network 306 via the network connection 304.
- a new on-premise device 300 is powered up (and/or electrically connected to other on-premise systems) and attempts to obtain provisioning.
- the new on-premise device 300 connects to an on-premise gateway system 302 and finds that the network connection 304 to an Internet communications network 306 (referred to as a type of “off- premise communications network”) is unavailable.
- an off- premise communications network referred to as a type of “off- premise communications network”
- provisioning by an off- premise DPS system 308 is unavailable at that time.
- the new on-premise device 300 initiates a discovery process within an on-premise communications network 312.
- the discovery process identifies a discovery endpoint 307 associated with an on-premise DPS 310.
- the on premise DPS 310 is capable of provisioning on-premise devices, securely registering them to work with other on-premise solutions, such as one or more on-premise solutions 314. If successful, the discovery process allows the new on-premise device 300 to identify and set up communications with the on-premise DPS 310 in the on-premise gateway system 302. Thereafter, the new on-premise device 300 can obtain provisioning from the on-premise DPS 310 using standard device provisioning service protocols.
- the on-premise DPS 310 attempts to authenticate the new on-premise device 300 (typically challenging the new on-premise device 300 to prove its identity).
- the on-premise DPS 310 relies on an on-premise identity brokering system 309 to provide and/or store cryptographic identities of the one or more on-premise solutions 314.
- Such cryptographic identities are a type of device provisioning record that may be generated by an in-gateway certificate authority or another identity issuer. Such identities may also be generated off-premise and communicated to and stored on the on-premise identity brokering system 309 when the Internet connection is active.
- Other device provisioning records such as public keys, SSIDs, enrollment records, etc., may also be stored by the on-premise DPS 310 or the on-premise identity brokering system 309.
- the on-premise DPS 310 registers the identity of the new on-premise device 300 to communicate with the one or more on-premise solutions 314.
- Other provisioning operations may also be employed, including without limitation, setting and enforcing policies, setting SSIDs, storing local SSIDs and credentials, and other operational parameters. In this way, the new on-premise device 300 is provisioned to work/interact with the one or more on-premise solutions 314.
- FIG. 4 illustrates an example offline device provisioning system 401that supports with pre-provisioning enrollment and/or post-provisioning enrollment.
- the on-premise gateway system 402 receives device provisioning records for one or more in-gateway solutions 413, one or more on-premise solutions 415, and/or the new on premise device 400.
- the new on-premise device 400 is purchased off- premise and registered with an off-premise DPS system 408.
- the device provisioning records for the new on-premise device 400 (and other solutions) can be received from the off-premise DPS system 408 in anticipation of a provisioning request from the new on-premise device 400.
- the on-premise DPS 410 is already configured with relevant device provisioning records to provision the new on premise device 400 to work with other solutions, such as the one or more in-gateway solutions 413 and/or the one or more on-premise solutions 415.
- device provisioning records generated by the on-premise DPS 410 are communicated to the off-premise DPS system 408 when the network connection 404 is re-established.
- the on-premise gateway system 402 can transmit device provisioning records for one or more in-gateway solutions 413, one or more on-premise solutions 415, and/or the new on-premise device 400 through the network connection 404 to the off-premise DPS system 408.
- the new on-premise device 400 is purchased off-premise and transported to the on-premise location.
- the on premise DPS 410 When the new on-premise device 400 attempts to obtaining provisioning and finds that the network connection 404 is not active, the on premise DPS 410 generates and/or applies its own on-premise device provisioning records (e.g., using an in-gateway identity brokering system or an on-premise identity brokering system) to provision the new on-premise device 400 to communicate with the one or more in-gateway solutions 413 and/or the one or more on-premise solutions 415. Thereafter, when the network connection 404 is re-established, the on-premise device provisioning records generated and/or applied by the on-premise DPS 410 registered with an off- premise DPS system 408. Furthermore, the off-premise DPS system 408 can also, at that time, provision the new on-premise device 400 for access to off-premise solutions, such as off-premise workloads 420, off-premise devices 422, and/or off-premise service systems 424.
- off-premise DPS system 408 can also, at that time, provision the new on-premise device
- the off-premise DPS system 408 can provide feedback to the on-premise DPS 410 or to the new on-premise device 400, changing its provisioning of the new on-premise device 400.
- the off-premise DPS system 408 instruct the on-premise DPS 410 to de-provision the new on premise device 400 for a particular on-premise solution, thereby terminating the ability for the new on-premise device 400 and the particular on-premise solution to interact.
- the off-premise DPS system 408 can supersede or overwrite the provisioning provided by the on-premise DPS 410, provisioning the new on-premise device 400 for its own purposes. In this fashion, the off-premise DPS system 408 can have a parent-child hierarchical relationship with the on-premise DPS 410, such that the off- premise DPS system 408 has priority over the on-premise DPS 410.
- FIG. 5 illustrates example operations 500 for offline provisioning with pre provisioning enrollment.
- a connecting operation 502 connects a network connection between an on-premise gateway system in an on-premise communications network and an off-premise device provisioning service system in an off-premise communications network.
- a communication operation 504 communicates one or more device provisioning records from the off-premise device provisioning service system to an on-premise device provisioning service of the on-premise gateway system via the network connection.
- Example provisioning records may include without limitation certificates, public keys, credentials, and other provisioning parameters.
- a disconnecting operation 506 disconnects the network connection between the on-premise communications network and the off- premise communications network.
- a responding operation 508 responds to a discovery request from an on premise device via the on-premise communications network, while the network connection is disconnected between the on-premise gateway system in the on-premise communications network and the off-premise device provisioning service system in the off-premise communications network.
- a receiving operation 510 receives, at the on-premise device provisioning service of the on premise gateway system, a provisioning request from the on-premise device via the on premise communications network, while the network connection is disconnected.
- the on-premise device provisioning service of the on-premise gateway system provisions the on-premise device based on the one or more provisioning records, while the network connection is disconnected.
- FIG. 6 illustrates example operations 600 for offline provisioning with post-provisioning enrollment.
- a disconnecting operation 602 disconnects a network connection between an on-premise communications network and an off-premise communications network.
- the on-premise communications network includes an on premise gateway system, including an on-premise device provisioning service.
- the off- premise communications network includes an off-premise device provisioning system.
- a responding operation 604 responds to a discovery request from an on premise device via the on-premise communications network, while the network connection is disconnected between the on-premise gateway system in the on-premise communications network and the off-premise device provisioning service system in the off-premise communications network.
- a receiving operation 606 receives, at the on-premise device provisioning service of the on premise gateway system, a provisioning request from the on-premise device via the on premise communications network, while the network connection is disconnected.
- the on-premise device provisioning service of the on-premise gateway system provisions the on-premise device based on the one or more provisioning records, while the network connection is disconnected.
- Example provisioning records may include without limitation certificates, public keys, credentials, and other provisioning parameters.
- a connecting operation 610 connects the network connection between an on-premise gateway system in an on-premise communications network and an off-premise device provisioning service system in an off-premise communications network, after the provisioning operation 608.
- a communication operation 612 communicates the one or more device provisioning records from the on-premise device provisioning service of the on-premise gateway system to the off-premise device provisioning service via the network connection.
- FIG. 7 illustrates an example communication device 700 for implementing the features and operations of the described technology.
- the communication device 700 is an example network-connected device and maybe a client device, such as a laptop, mobile device, desktop, tablet; a server/cloud device; an internet-of-things device; an electronic accessory; or another electronic device.
- the communication device 700 includes one or more processor(s) 702 and a memory 704.
- the memory 704 generally includes both volatile memory (e.g., RAM) and nonvolatile memory (e.g., flash memory).
- An operating system 710 resides in the memory 704 and is executed by the processor(s) 702.
- an example communication device 700 as shown in FIG. 7, one or more modules or segments, such as applications 750, an on-premise device provisioning service, a discovery endpoint, brokering services, and other services, workloads, and modules, are loaded into the operating system 710 on the memory 704 and/or storage 720 and executed by processor(s) 702.
- the storage 720 includes one or more tangible storage media devices and may store enrollment records, identities, provisioning records, public keys, certificates, cryptographic data elements, and other data and be local to the communication device 700 or may be remote and communicatively connected to the communication device 700.
- the communication device 700 includes a power supply 716, which is powered by one or more batteries or other power sources and which provides power to other components of the communication device 700.
- the power supply 716 may also be connected to an external power source that overrides or recharges the built-in batteries or other power sources.
- the communication device 700 may include one or more communication transceivers 730 which may be connected to one or more antenna(s) 732 to provide network connectivity (e.g., mobile phone network, Wi-Fi®, Bluetooth®) to one or more other servers and/or client devices (e.g., mobile devices, desktop computers, or laptop computers).
- the communication device 700 may further include a network adapter 736, which is a type of communication device.
- the communication device 700 may use the adapter and any other types of communication devices for establishing connections over a wide-area network (WAN) or local -area network (LAN). It should be appreciated that the network connections shown are exemplary and that other communication devices and means for establishing a communications link between the communication device 700 and other devices may be used.
- the communication device 700 may include one or more input devices 734 such that a user may enter commands and information (e.g., a keyboard or mouse). These and other input devices may be coupled to the server by one or more interfaces 738, such as a serial port interface, parallel port, or universal serial bus (USB).
- the communication device 700 may further include a display 722, such as a touch screen display.
- the communication device 700 may include a variety of tangible processor-readable storage media and intangible processor-readable communication signals.
- Tangible processor-readable storage can be embodied by any available media that can be accessed by the communication device 700 and includes both volatile and nonvolatile storage media, removable and non-removable storage media.
- Tangible processor-readable storage media excludes communications signals and includes volatile and nonvolatile, removable and non-removable storage media implemented in any method or technology for storage of information such as processor-readable instructions, data structures, program modules or other data.
- Tangible processor-readable storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CDROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other tangible medium which can be used to store the desired information and which can be accessed by the communication device 700.
- intangible processor-readable communication signals may embody processor-readable instructions, data structures, program modules or other data resident in a modulated data signal, such as a carrier wave or other signal transport mechanism.
- modulated data signal means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal.
- intangible communication signals include signals traveling through wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared, and other wireless media.
- An example method of provisioning an on-premise device within an on premise communications network includes connecting, via a network connection, an on premise gateway system in the on-premise communications network with an off-premise device provisioning service system in an off-premise communications network, communicating one or more device provisioning records between the off-premise device provisioning service system and an on-premise device provisioning service of the on premise gateway system via the network connection, disconnecting the network connection between the on-premise communications network and the off-premise communications network, responding to a discovery request received from the on-premise device via the on-premise communications network, while the network connection is disconnected, receiving, at the on-premise device provisioning service of the on-premise gateway system, a provisioning request from the on-premise device via the on-premise communications network, while the network connection is disconnected, responsive to the responding operation, and provisioning, by the on-premise device provisioning service of the on-premise gateway system, the on-premise device based on the one or more provisioning records, while the network connection is disconnected, responsive to receiving the provisioning request.
- Another example method of any preceding method is provided, wherein the operations of responding to the discovery request, receiving the provisioning request, and provisioning the on-premise device occur before the communicating operation and the disconnecting operation.
- Another example method of any preceding method is provided, wherein the operations of responding to the discovery request, receiving the provisioning request, and provisioning the on-premise device occur after the communicating operation and the disconnecting operation.
- provisioning operation includes authenticating the on-premise device using the one or more device provisioning records via the on-premise communications network.
- the provisioning operation includes registering a cryptographic identity of the on-premise device to access one or more in-gateway solutions.
- provisioning records are sourced from an on-premise identity system communicatively coupled to the on-premise gateway system by the on-premise communications network
- provisioning operation includes registering a cryptographic identity of the on-premise device to access one or more on-premise solutions external to the on-premise gateway system, wherein the one or more on-premise solutions are communicatively coupled to the on-premise gateway system by the on premise communications network.
- Another example method of any preceding method is provided, wherein the off-premise device provisioning service system registers a cryptographic identity of the on-premise device to access one or more off-premise solutions, after the communicating operation.
- An example on-premise gateway system for provisioning an on-premise device within an on-premise communications network includes one or more hardware processors, an off-premise network interface configured to communicate one or more provisioning records via a network connection with an off-premise device provisioning service system in the off-premise communications network, an on-premise network interface configured to communicate with an on-premise communications network, a discovery endpoint executed by the one or more hardware processors and configured to respond to a discovery request received from the on-premise device via the on-premise communications network, while the network connection is disconnected, and an on-premise device provisioning service executed by the one or more hardware processors.
- the off-premise network interface is configured to communicate one or more device provisioning records between the off-premise device provisioning service system and the on-premise device provisioning service via the network connection, while the network connection is connected.
- the on-premise device provisioning service is configured to receive a provisioning request from the on-premise device via the on-premise communications network, while the network connection is disconnected, and to provision the on-premise device based on the one or more provisioning records, while the network connection is disconnected.
- Another example on-premise gateway system of any preceding system is provided, wherein the discovery endpoint is configured to respond to the discovery request, and the on-premise device provisioning service is configured to receive the provisioning request and provision the on-premise device, before the off-premise network interface communicates the one or more provisioning records with the off-premise device provisioning service system and before the network connection is disconnected.
- Another example on-premise gateway system of any preceding system is provided, wherein the discovery endpoint is configured to respond to the discovery request, and the on-premise device provisioning service is configured to receive the provisioning request and provision the on-premise device, after the off-premise network interface communicates the one or more provisioning records with the off-premise device provisioning service system and after the network connection is disconnected.
- Another example on-premise gateway system of any preceding system is provided, wherein the on-premise device provisioning service is configured to authenticate the on-premise device using the one or more device provisioning records via the on premise communications network.
- Another example on-premise gateway system of any preceding system is provided, wherein the one or more provisioning records are sourced from a gateway identity brokering system of the on-premise gateway system, and the on-premise device provisioning service is configured to register a cryptographic identity of the on-premise device to access one or more in-gateway solutions.
- Another example on-premise gateway system of any preceding system wherein the one or more provisioning records are sourced from an on-premise identity system communicatively coupled to the on-premise gateway system by the on premise communications network, and the on-premise device provisioning service is configured to register a cryptographic identity of the on-premise device to access one or more on-premise solutions external to the on-premise gateway system, wherein the one or more on-premise solutions are communicatively coupled to the on-premise gateway system by the on-premise communications network.
- Another example on-premise gateway system of any preceding system is provided, wherein the off-premise device provisioning service system is further configured to register a cryptographic identity of the on-premise device to access one or more off- premise solutions after the one or more provisioning records are communicated to the off- premise device provisioning service system via the off-premise network interface.
- One or more example tangible processor-readable storage media of a tangible article of manufacture encodes processor-executable instructions for executing on an electronic computing device a process of provisioning an on-premise device within an on-premise communications network.
- the process includes connecting, via a network connection, an on-premise gateway system in the on-premise communications network with an off-premise device provisioning service system in an off-premise communications network, communicating one or more device provisioning records between the off-premise device provisioning service system and an on-premise device provisioning service of the on-premise gateway system via the network connection, disconnecting the network connection between the on-premise communications network and the off-premise communications network, responding to a discovery request received from the on-premise device via the on-premise communications network, while the network connection is disconnected, receiving, at the on-premise device provisioning service of the on-premise gateway system, a provisioning request from the on-premise device via the on-premise communications network, while the network connection is disconnected, responsive to the responding operation, and provisioning, by the on-premise device provisioning service of the on-premise gateway
- FIG. 1 Other one or more example tangible processor-readable storage media of any preceding storage media are provided, wherein the one or more provisioning records are sourced from a gateway identity brokering system of the on-premise gateway system, and the provisioning operation includes registering a cryptographic identity of the on premise device to access one or more in-gateway solutions.
- FIG. 1 Other one or more example tangible processor-readable storage media of any preceding storage media are provided, wherein the one or more provisioning records are sourced from an on-premise identity system communicatively coupled to the on premise gateway system by the on-premise communications network, and the provisioning operation includes registering a cryptographic identity of the on-premise device to access one or more on-premise solutions external to the on-premise gateway system, wherein the one or more on-premise solutions are communicatively coupled to the on-premise gateway system by the on-premise communications network.
- An example system of provisioning an on-premise device within an on premise communications network includes means for connecting, via a network connection, an on-premise gateway system in the on-premise communications network with an off-premise device provisioning service system in an off-premise communications network, means for communicating one or more device provisioning records between the off-premise device provisioning service system and an on-premise device provisioning service of the on-premise gateway system via the network connection, means for disconnecting the network connection between the on-premise communications network and the off-premise communications network, means for responding to a discovery request received from the on-premise device via the on-premise communications network, while the network connection is disconnected, means for receiving, at the on-premise device provisioning service of the on-premise gateway system, a provisioning request from the on-premise device via the on-premise communications network, while the network connection is disconnected, responsive to the responding operation, and means for provisioning, by the on-premise device provisioning service of the on-premise gateway system, the on-premise device based on the one or more provisioning records, while the network connection is disconnected
- the means for provisioning includes means for authenticating the on-premise device using the one or more device provisioning records via the on-premise communications network.
- provisioning records are sourced from a gateway identity brokering system of the on-premise gateway system, and the means for provisioning includes means for registering a cryptographic identity of the on-premise device to access one or more in gateway solutions.
- the one or more provisioning records are sourced from an on-premise identity system communicatively coupled to the on-premise gateway system by the on-premise communications network
- the means for provisioning includes means for registering a cryptographic identity of the on-premise device to access one or more on-premise solutions external to the on-premise gateway system, wherein the one or more on-premise solutions are communicatively coupled to the on-premise gateway system by the on premise communications network.
- Another example system of any preceding system is provided, wherein the off-premise device provisioning service system registers a cryptographic identity of the on-premise device to access one or more off-premise solutions, after the means for communicating operates.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- Automation & Control Theory (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Power Engineering (AREA)
- Mobile Radio Communication Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US16/853,122 US20210328865A1 (en) | 2020-04-20 | 2020-04-20 | Offline device provisioning |
PCT/US2021/020969 WO2021216203A1 (en) | 2020-04-20 | 2021-03-04 | Offline device provisioning |
Publications (1)
Publication Number | Publication Date |
---|---|
EP4140113A1 true EP4140113A1 (de) | 2023-03-01 |
Family
ID=75223497
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP21714567.1A Pending EP4140113A1 (de) | 2020-04-20 | 2021-03-04 | Offline-vorrichtungsbereitstellung |
Country Status (4)
Country | Link |
---|---|
US (1) | US20210328865A1 (de) |
EP (1) | EP4140113A1 (de) |
CN (1) | CN115486029A (de) |
WO (1) | WO2021216203A1 (de) |
Family Cites Families (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20030070063A1 (en) * | 2001-10-05 | 2003-04-10 | Adc Telecommunications, Inc. | Configuration file caching |
US9064117B1 (en) * | 2011-09-20 | 2015-06-23 | Amazon Technologies, Inc. | Mobile provisioning device |
US9913143B1 (en) * | 2016-11-28 | 2018-03-06 | Amazon Technologies, Inc. | Auto-provisioning device |
US10713007B2 (en) * | 2017-12-12 | 2020-07-14 | Amazon Technologies, Inc. | Architecture for a hub configured to control a second device while a connection to a remote system is unavailable |
-
2020
- 2020-04-20 US US16/853,122 patent/US20210328865A1/en active Pending
-
2021
- 2021-03-04 WO PCT/US2021/020969 patent/WO2021216203A1/en unknown
- 2021-03-04 CN CN202180029603.2A patent/CN115486029A/zh active Pending
- 2021-03-04 EP EP21714567.1A patent/EP4140113A1/de active Pending
Also Published As
Publication number | Publication date |
---|---|
US20210328865A1 (en) | 2021-10-21 |
WO2021216203A1 (en) | 2021-10-28 |
CN115486029A (zh) | 2022-12-16 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US11153754B2 (en) | Devices, systems and methods for connecting and authenticating local devices to common gateway device | |
US11356417B2 (en) | Private cloud routing server connection mechanism for use in a private communication architecture | |
US9596603B2 (en) | Distributed bulk onboarding process | |
US9923978B2 (en) | Automated network service discovery and communication | |
CN109644522B (zh) | 用于通过无线网络安全加载设备的方法和*** | |
US11917399B2 (en) | Zero-touch deployment (ZTD) of cellular IoT devices and associated trust model | |
TWI590693B (zh) | 連網裝置的網路設定方法及系統 | |
US11863529B2 (en) | Private cloud routing server connection mechanism for use in a private communication architecture | |
US10389581B2 (en) | Access-point controller discovery via an intermediary | |
CN112198805A (zh) | 设备控制方法、装置、***以及计算设备和存储介质 | |
US10091205B2 (en) | Zeroconf profile transferring to enable fast roaming | |
US20200274707A1 (en) | Server for and method of secure device registration | |
US20200274719A1 (en) | Generating trust for devices | |
US20210328865A1 (en) | Offline device provisioning | |
US20230188505A1 (en) | Accessing cloud environment with zero trust network access | |
US11683292B2 (en) | Private cloud routing server connection mechanism for use in a private communication architecture | |
GB2607362A (en) | Private cloud routing server connection mechanism for use in a private communication architecture | |
CN111385371B (zh) | Mac地址获取方法、装置和设备 | |
US20230224292A1 (en) | Onboarding for cloud-based management | |
CN109376024B (zh) | 一种服务信息配置方法与装置 | |
GB2609677A (en) | Private cloud routing server connection mechanism for use in a private communication architecture | |
CN117014251A (zh) | 一种用于私有通信架构的私有物质网关链接机制 | |
WO2021239249A1 (en) | Devices and methods for zero touch provisioning in a communication network | |
CN117917048A (zh) | 对桥接设备进行配置的方法、装置、设备及存储介质 | |
GB2544675A (en) | Private cloud routing server connection mechanism for use in a private communication architecture |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: UNKNOWN |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE |
|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE |
|
17P | Request for examination filed |
Effective date: 20221012 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
DAV | Request for validation of the european patent (deleted) | ||
DAX | Request for extension of the european patent (deleted) |